CORS headers list required for CSET Enterprise (Angular frontend → .NET API)

[scjeff]

I’m deploying CSET Enterprise on IIS and running into repeated CORS issues. The Angular frontend is making cross-origin calls to the .NET API, and the preflight requests are failing because the IIS server is missing some custom headers.

So far I’ve seen the need to allow these headers:
content-type authorization x-requested-with x-xsrf-token pwd username assessmentid

I can copy them one-by-one from the browser’s Access-Control-Request-Headers, but this feels like a game of whack-a-mole.

My questions:

Is there an authoritative list of the custom headers the Angular client for CSET Enterprise will send?

Are there best practices recommended by the CSET team (or community) for managing this in IIS?

Should we expect the header set to change across versions, or is it stable enough to hard-code into <allowHeaders>?

Any official guidance or examples would be very helpful.

Thanks!

[martbillinl]

We're looking into this

[randywoods]

In our development environment we run with CORS wide open, but when I create a more restrictive policy with the following headers, everything seems to be accessible: content-type, authorization, noauth, x-cset-noauth, expseconds, remoteauthorization, refresh, accept, assessmentid, aggregationid.
Can you share which requests required x-requested-with, x-xsrf-token, pwd and username?